- adding the require-any-roles attributes to the resource

doc.go

@@ -130,6 +130,8 @@ type Resource struct {
 	Methods []string `json:"methods" yaml:"methods"`
 	// WhiteListed permits the prefix through
 	WhiteListed bool `json:"white-listed" yaml:"white-listed"`
+	// RequireAnyRole indicates that ANY of the roles are required, the default is all
+	RequireAnyRole bool `json:"require-any-role yaml:"require-any-role"`
 	// Roles the roles required to access this url
 	Roles []string `json:"roles" yaml:"roles"`
 	// Groups is a list of groups the user is in

resource.go

@@ -51,6 +51,12 @@ func (r *Resource) parse(resource string) (*Resource, error) {
 					r.Methods = allHTTPMethods
 				}
 			}
+		case "require-any-role":
+			v, err := strconv.ParseBool(kp[1])
+			if err != nil {
+				return nil, err
+			}
+			r.RequireAnyRole = v
 		case "roles":
 			r.Roles = strings.Split(kp[1], ",")
 		case "groups":

resource_test.go

@@ -30,6 +30,7 @@ func TestDecodeResourceBad(t *testing.T) {
 		{Option: "uri"},
 		{Option: "uri=hello"},
 		{Option: "uri=/|white-listed=ERROR"},
+		{Option: "uri=/|require-any-role=BAD"},
 	}
 	for i, c := range cs {
 		if _, err := newResource().parse(c.Option); err == nil {
@@ -79,6 +80,10 @@ func TestResourceParseOk(t *testing.T) {
 			Option:   "uri=/*|groups=admin",
 			Resource: &Resource{URL: "/*", Methods: allHTTPMethods, Groups: []string{"admin"}},
 		},
+		{
+			Option:   "uri=/*|require-any-role=true",
+			Resource: &Resource{URL: "/*", Methods: allHTTPMethods, RequireAnyRole: true},
+		},
 	}
 	for i, x := range cs {
 		r, err := newResource().parse(x.Option)